Bug 65490 - DFG JIT sometimes creates speculation check data structures that have invalid information about the format of a register
Summary: DFG JIT sometimes creates speculation check data structures that have invalid...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-01 14:39 PDT by Filip Pizlo
Modified: 2011-08-01 15:32 PDT (History)
3 users (show)

See Also:

Attachments
the patch (5.41 KB, patch)
2011-08-01 15:03 PDT, Filip Pizlo 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2011-08-01 14:39:04 PDT 
The DFG JIT speculation failure code requires knowing the format in which values are stored on both the speculative, and non-speculative, paths.  For example, a number may be either boxed, unboxed as an integer, or unboxed as a double.  But sometimes the speculative JIT creates a speculation failure in which it fails to correctly set the data format of a register, leading to either incorrect speculation failure code, or assertion failures.
Comment 1 Filip Pizlo 2011-08-01 15:03:05 PDT 
Created attachment 102564 [details]
the patch
Comment 2 WebKit Review Bot 2011-08-01 15:32:22 PDT 
Comment on attachment 102564 [details]
the patch

Clearing flags on attachment: 102564

Committed r92148: <http://trac.webkit.org/changeset/92148>
Comment 3 WebKit Review Bot 2011-08-01 15:32:26 PDT 
All reviewed patches have been landed.  Closing bug.